DPDP for Insurance Companies: Protecting Policyholder Data

An insurance application can reveal a person's identity, medical history, income, family details, and financial commitments. That information may pass through agents, underwriters, hospitals, TPAs, and technology providers before a policy is issued. The challenge is knowing who can access it, why they need it, and when that access should end.

The DPDP Act for insurance companies makes these questions central to privacy governance. With key provisions scheduled to commence in May 2027, insurers need to examine how policyholder data moves across their operations and whether existing controls can support the new requirements.

Why Insurance Data Carries Higher Privacy Risk in India

Insurance applications combine identity, financial, medical, and family information. A single proposal form may contain:

• Identity and KYC: PAN, address, identity documents, and contact details.
• Health information: Medical history, diagnostic reports, and treatment details.
• Financial information: Income, occupation, and payment records.
• Family information: Dependents, nominee details, and relevant family medical history.

The risk increases when these records move between agents, insurers, underwriters, TPAs, hospitals, claims teams, fraud detection systems, reinsurers, and archives.

Effective policyholder data protection practices in India require insurers to map each transfer and establish who receives the data, why it is needed, how much is shared, and how long it must be retained.

Long-running policies and unresolved claims complicate deletion. Information collected years ago may remain in archives, legacy applications, and vendor systems. A complete data mapping solution helps identify unnecessary copies and determine whether continued storage and access remain justified.

Example: A Health Insurance Claim

A policyholder is hospitalized for surgery and submits a claim to their health insurer. The hospital sends the necessary medical reports and diagnostic results to the Third-Party Administrator (TPA) for verification. The TPA forwards the relevant records to the insurer for claim approval, while the claims-processing system uses the required details to process the payment.

The insurer maps the information shared at each stage, verifies that each transfer serves a defined purpose, restricts access to authorized personnel, and establishes how long each record must be retained.

Does the DPDP Act Apply to Insurance Companies?

Yes. The DPDP Act for insurance companies in India applies to personal data processing within the Act's scope. Each organization's responsibilities depend on its role in the processing activity.

• Data Fiduciary: Determines why and how personal data is processed. An insurer generally occupies this role for its policyholder operations.
• Data Processor: Processes personal data on behalf of a Data Fiduciary. A TPA may perform this role when administering claims under an insurer's instructions.
• Significant Data Fiduciary: An organization notified by the Central Government under the Act, subject to additional statutory obligations.

These roles depend on actual processing arrangements, not simply the labels in a contract. An intermediary may have different roles for different activities.

Insurers should check whether TPAs and vendors follow documented instructions and whether contracts define permitted uses, access, retention, deletion, and incident escalation.

Under Section 8(1), a Data Fiduciary remains responsible for processing undertaken on its behalf by a Data Processor. Insurers should assess whether additional requirements could apply if they are notified as a Significant Data Fiduciary.

The same assessment should cover brokers, agents, point-of-sale persons (POSPs), and web aggregators. Their obligations depend on their actual processing activities and roles under the Act.

What Changes for Consent in Insurance

A customer agreeing to buy a policy should understand how their data will be used. A single consent covering underwriting, claims, policy servicing, marketing, and cross-selling can obscure the differences between these purposes.

Insurers should review purpose-wise consent across proposal forms, applications, agent-assisted journeys, digital KYC, call centers, and renewals.

Make Consent Clear at Every Customer Touchpoint

• Clear privacy notice: Explain what personal data is collected and why it is needed.
• Language support: Prepare notices that meet the Rules' language requirements, including applicable Eighth Schedule language options.
• Purpose-specific choices: Distinguish information needed for policy operations from optional marketing or cross-selling activities.
• Consistent records: Maintain timestamps, notice versions, consent status, and evidence of customer choices.

The notice requirements in the DPDP Rules, 2025, are scheduled to commence in May 2027. Insurers can prepare their systems and customer journeys ahead of that date.

For consent for health insurance data, insurers should explain the relevant purpose without implying that permission for claims processing automatically authorizes marketing or unrelated uses.

Consent withdrawal also needs an operational process. Insurers should define how withdrawal affects relevant systems and processors while identifying information that must still be retained under applicable law. A registered Consent Manager may support consent management, but it does not replace the insurer's own obligations.

How Insurers Should Protect Health and Sensitive Data

The DPDP Act does not create a separate legal category called sensitive personal data. However, health records, financial details, and identity documents can create significant privacy risks if exposed or misused.

Insurers should apply data minimization and restrict access according to business need.

• Collect only what is necessary. Remove fields that do not serve a defined purpose.
• Restrict medical records. Give access to authorized underwriting, claims, or medical review personnel.
• Maintain a data inventory. Map personal data across policy systems, claims platforms, document stores, and archives.
• Log access. Record who accessed sensitive records and when.
• Prepare for erasure requests. Identify where personal data resides so requests can be assessed across connected systems.

When Can Health Data Be Processed Without Consent?

Section 7 sets out certain legitimate uses, including processing necessary to respond to a medical emergency involving a threat to life or an immediate threat to health.

This is not a blanket exemption for routine underwriting, marketing, or cross-selling. Insurers should assess the circumstances and applicable legal basis before relying on this provision.

Who Is Accountable When a TPA, Agent, or Vendor Leaks Data?

An insurer's data protection controls must extend to organizations handling information on its behalf. These may include TPAs, brokers, agents, hospitals, diagnostic centers, surveyors, garages, call centers, and technology vendors.

TPA data protection compliance requires defined responsibilities, appropriate safeguards, and evidence that controls are working.

Third-Party Controls Insurers Should Implement

• Vendor due diligence: Review security practices, access controls, incident history, and subcontracting arrangements.
• Contractual safeguards: Define permitted processing, confidentiality, retention, deletion, and incident escalation.
• Secure transfers: Use approved portals and managed channels to exchange policyholder documents.
• Agent controls: Prevent indefinite storage of KYC documents and medical records on personal devices or unapproved messaging apps.
• Audit trails: Maintain records of access, transfers, incidents, and corrective actions.
• Deletion confirmation: Establish how vendors return or delete data when the applicable retention period ends.

The insurer should define how quickly a processor must report a suspected incident and which team coordinates the investigation. Contracts matter, but they need to be supported by operational procedures and periodic checks. For a deeper look, see our guide to vendor risk management under the DPDP Act.

Retention and Deletion: Reconciling DPDP with IRDAI Rules

Insurers must balance applicable insurance recordkeeping requirements with DPDP obligations concerning retention and erasure. The answer is not to delete every record immediately after a policy ends, nor to keep every record indefinitely.

The IRDAI data retention DPDP review should establish a documented data retention schedule based on the record type, purpose, applicable legal requirement, and deletion trigger.

Three Rules for a Workable Retention Policy

• Retain for a defined reason. Record the legal or operational basis for keeping each category of data.
• Separate retention from use. A record retained for regulatory purposes should not automatically remain available for marketing or unrelated analytics.
• Control deletion across systems. Include live applications, archives, backups, and relevant third-party copies in the deletion process.

Exact retention periods must be verified against the applicable IRDAI provision for each record category. A universal period should not be assumed for all insurance records.

Under IRDAI's 2025 regulations, covered insurance records generally need to be retained for at least 10 years, subject to specified exceptions and longer applicable legal requirements. Insurers must balance these obligations with DPDP erasure requirements and establish clear retention and deletion policies. Our guide on data retention policy under the DPDP Act explains how to build one.

The DPDP Nominee Is Not the Policy Nominee

Section 14 of the DPDP Act addresses nomination for exercising a Data Principal's rights in specified circumstances involving death or incapacity. This is different from the nominee recorded under an insurance policy.

An insurance policy nominee is associated with policy benefits and claim arrangements. A DPDP nominee is designated to exercise applicable data protection rights in the specified circumstances. The same person may be nominated for both roles, but insurers should not assume that this is always the case.

What Insurers Should Do

• Capture the two nominations separately where applicable.
• Explain the purpose of each nomination during onboarding.
• Verify the requester's identity and authority before processing a request.
• Maintain relevant consent records, request records, decisions, and access logs.

These procedures help prevent unauthorized disclosure when family members or representatives contact an insurer after a policyholder's death or incapacity.

AI Underwriting, Fraud Scoring, and Telematics

AI and analytics can support underwriting, claims triage, fraud detection, risk scoring, and personalized offers. They can also create privacy risks when customer information is reused without a clearly defined purpose.

Where Insurers Should Examine Data Use

• AI underwriting: Document the data used for risk assessment, the intended purpose, and how outputs are reviewed.
• Fraud scoring: Ensure the information is relevant to the investigation and restricted to authorized teams.
• Claims automation: Define which data supports decisions and when human review is required.
• Model training: Review whether customer data is reused for training and whether that use is appropriately covered.
• Telematics: Assess whether GPS, driving behavior, or wearable data is collected only to the extent necessary.

For AI underwriting data privacy, insurers should document each model's inputs, purpose, outputs, access permissions, retention, and oversight. Data collected for fraud detection or claims processing should not automatically be reused for model training or unrelated purposes. Read more in our guide to AI and machine learning under the DPDP Act.

Telematics data needs particular attention because it may reveal location patterns, driving habits, or health-related information over time. Insurers should establish how frequently data is collected, how much detail is necessary, and when collection should stop.

A documented review before deployment can identify unnecessary data collection, unclear purposes, excessive retention, and inappropriate access.

Breach Reporting and Cross-Border Transfers

An insurance data breach may expose KYC documents, medical records, claims information, or policyholder account details. Response plans should connect privacy, security operations, legal, communications, and relevant third-party teams.

Breach Response Essentials

• Identify: Determine the affected data, individuals, systems, and third parties.
• Contain: Restrict unauthorized access and preserve evidence.
• Assess: Establish the cause, impact, and applicable notification requirements.
• Notify: Coordinate required regulatory and individual notifications within the applicable timelines.
• Remediate: Address the cause and document corrective actions.

The DPDP Rules, 2025, prescribe breach notification requirements, including notifying affected Data Principals without delay and notifying the Data Protection Board without delay, with detailed information within 72 hours unless a longer period is allowed.

These provisions are scheduled to commence in May 2027. Insurers must separately assess currently applicable IRDAI and other incident-reporting obligations.

For insurance data breach reporting in India, teams should test their escalation process before an incident occurs. The process should identify who makes the notification decision, who prepares the information, and who coordinates with affected processors.

Cross-Border Data Transfers

Insurers should map information shared with reinsurers and global service providers. For each cross-border data transfer, document the recipient, location, purpose, data categories, safeguards, and applicable legal or regulatory restrictions. See our guide on cross-border data transfers under the DPDP Act for more detail.

This helps teams understand where policyholder information travels and how an incident affecting an overseas system would be handled.

Penalties for Insurers Under the DPDP Act

The DPDP Act establishes maximum monetary penalties for specified failures. These are statutory ceilings, not automatic fines. The Data Protection Board of India determines penalties under the Act's framework.

• Up to ₹250 crore: Failure to take reasonable security safeguards.
• Up to ₹200 crore: Failure to notify a personal data breach as required.
• Up to ₹200 crore: Breach of additional obligations relating to children's data.
• Up to ₹150 crore: Breach of additional Significant Data Fiduciary obligations.

The applicable provision depends on the facts. Separate failures may raise separate issues, so insurers should not treat the maximum penalty as the expected outcome of every incident. Learn more about DPDP Act non-compliance penalties.

For organizations handling large volumes of policyholder data, weak access controls, missing records, and poor vendor oversight can also complicate investigations and make it harder to demonstrate that appropriate measures were taken.

How Insurance Companies Can Build DPDP Readiness

DPDP readiness requires coordinated changes across policy administration, underwriting, claims, distribution, security, and vendor management. A revised privacy policy alone will not address gaps in legacy applications or third-party systems.

Five Practical Steps

1. Map the Full Data Lifecycle

Identify personal data across onboarding, underwriting, policy servicing, claims, renewals, legacy applications, backups, and shadow databases. Record where data resides and who can access it.

2. Review Consent and Privacy Notices

Connect each collection point to a defined purpose. Maintain timestamps and notice versions, and prepare for applicable language and withdrawal requirements.

3. Align Retention and Deletion

Create a data retention schedule based on applicable IRDAI and legal requirements. Define deletion triggers, automate routine actions where possible, and document exceptions.

4. Strengthen Third-Party Governance

Conduct vendor due diligence and review contracts, access rights, subcontractors, incident escalation, and deletion procedures.

5. Review New Products and Technologies

Assess privacy implications before introducing new products, apps, partnerships, TPAs, AI models, or data sources. Include privacy, legal, security, and business owners in the review.

The Ministry of Electronics and Information Technology (MeitY) has notified the DPDP framework. Insurers should base implementation plans on the published Act, Rules, and commencement notifications rather than assuming that all provisions take effect on the same date.

The key substantive requirements are scheduled for May 2027, while the Consent Manager registration provision has an earlier commencement date. Insurers should track both milestones and assign owners, delivery dates, and evidence requirements to each workstream.

DPDP Readiness Checklist for Insurance Companies

Use this checklist to track the work required before the DPDP compliance deadline of May 2027. You can also refer to our DPDP compliance checklist for a broader view.

• Complete data mapping across insurer, TPA, agent, broker, and vendor systems.
• Review purpose-based consent and each privacy notice.
• Prepare notices in the required languages and retain version records.
• Enable practical consent withdrawal across relevant systems and processors.
• Record DPDP nominees separately from policy nominees.
• Align the data retention schedule with applicable IRDAI and legal requirements.
• Define deletion procedures for live systems, archives, backups, and vendor copies.
• Update vendor contracts and complete risk-based due diligence.
• Test breach detection, escalation, investigation, and notification workflows.
• Assess whether Significant Data Fiduciary obligations may apply.
• Prepare for applicable Data Protection Officer, impact assessment, and audit requirements.
• Maintain evidence of decisions, approvals, access controls, and remediation.

Assign an owner and due date to every item. Legal, privacy, information security, underwriting, claims, distribution, and technology teams should share responsibility for implementation, with progress reviewed regularly.

What Insurers Should Resolve Before the DPDP Deadline

The DPDP framework calls for more than updated notices or revised consent language. Insurers need to connect privacy commitments to the systems, people, and third parties that handle policyholder information every day.

The priorities are clear: map personal data across the policy lifecycle, establish purpose-based consent, document retention requirements, strengthen vendor oversight, and test breach response procedures. Insurers should also determine whether additional obligations could apply to them as Significant Data Fiduciaries.

Preparation should be measurable. Each workstream needs an accountable owner, a deadline, and evidence that the required controls operate as intended. This gives legal, privacy, security, underwriting, claims, and technology teams a shared basis for identifying gaps and resolving them before the relevant provisions commence.

FAQs

1. What Is the DPDP Act for Insurance Companies?

The DPDP Act, 2023, establishes a framework for processing digital personal data in India. It affects how insurers collect, use, share, secure, retain, and erase policyholder information, subject to the Act's scope and commencement schedule.

2. Are Insurance Companies Considered Data Fiduciaries Under the DPDP Act?

Generally, yes, when they determine the purpose and means of processing policyholder data. The role depends on the actual processing activity and arrangement.

3. Does the DPDP Act Apply to TPAs, Brokers, Agents, and Web Aggregators?

It can apply where their processing falls within the Act's scope. Their roles depend on whether they determine the purpose and means of processing or act on another organization's instructions.

4. Is Bundled Consent Still Valid for Insurance Proposal Forms?

Insurers should review bundled consent carefully. Notices and consent journeys should clearly explain the purposes of processing and distinguish necessary policy activities from optional uses such as marketing or cross-selling.

5. Can Insurers Process Health Data Without Consent in a Medical Emergency?

Section 7 includes certain legitimate uses, including processing necessary to respond to a medical emergency involving a threat to life or an immediate threat to health. It is not a blanket exemption for routine underwriting or marketing.

6. Who Is Responsible When a TPA or Vendor Causes a Data Breach?

Responsibility depends on the facts, roles, and applicable obligations. Under Section 8(1), a Data Fiduciary remains responsible for processing undertaken on its behalf by a Data Processor.

7. Is the DPDP Nominee the Same as the Insurance Policy Nominee?

No. A DPDP nominee relates to exercising applicable data protection rights in specified circumstances involving death or incapacity. An insurance policy nominee has a separate role relating to policy benefits and claims.

8. How Do IRDAI Record Retention Rules Work Alongside DPDP Erasure Requirements?

Insurers should identify the applicable retention requirement for each record type and document its legal basis. Records that must be retained should be restricted to permitted purposes, while data no longer required should be assessed for deletion.